topic Re: Run makeresults command through REST API is giving error in Splunk Search

Run makeresults command through REST API is giving error

denissotoacc — Fri, 07 Jul 2023 06:31:29 GMT

I receive the following error while trying to execute a simple "makeresults" command by using REST API call:

Used endpoint:
https://localhost:8089/servicesNS/nobody/myapp/search/jobs

Search example:

"| makeresults | eval name=\"denis\""

Error message:
"Error in 'makeresults' command: This command must be the first command of a search."

"search": "search | makeresults | eval nombre=\"denis\""

I see that the API call changes my search adding a "search" word before the search itself. How can I get riddle of that?

Re: Run makeresults command through REST API is giving error

kamlesh_vaghela — Fri, 07 Jul 2023 06:54:30 GMT

@denissotoacc

Can you please share your sample code?

Re: Run makeresults command through REST API is giving error

isoutamo — Fri, 07 Jul 2023 09:28:32 GMT

This should work

[soutamo@vega] ~> (0) $ curl -ku $PASS https://localhost:8089/servicesNS/-/search/search/jobs -d search=" |makeresults|eval name=\"denis\"" <?xml version="1.0" encoding="UTF-8"?> <response> <sid>1688721961.24</sid> </response> [soutamo@vega] ~> (0) $ export SID=1688721961.24 && curl -sku $PASS https://localhost:8089/services/search/jobs/$SID/results?output_mode=json|jq '.results' [ { "_time": "2023-07-07T12:26:02.000+03:00", "name": "denis" } ] [soutamo@vega] ~> (0) $

r. Ismo

Re: Run makeresults command through REST API is giving error

Nadhem9 — Mon, 08 Jul 2024 09:41:48 GMT

Try using this uri: https://<host>:<mPort>/services/search/v2/jobs/

The api uri that you are using is depricated.
To my knowledge, it deletes the "|" in the beginning of the SPL query, that's why you got the error "Error in 'makeresults' command: This command must be the first command of a search.".

What splunk receives from your query "search | makeresults | eval nombre=\"denis\"" with api call is this:
makeresults | eval nombre="denis"

AND NOT

| makeresults | eval nombre="denis"

https://docs.splunk.com/Documentation/Splunk/9.2.2/RESTREF/RESTsearch#search.2Fv2.2Fjobs.2F.7Bsearch_id.7D.2Fresults